ossclip 0.1.33 → 0.1.34

package/src/publish.ts

@@ -1,14 +1,24 @@
 import { existsSync } from "node:fs";
-import { readFile, writeFile } from "node:fs/promises";
+import { readFile, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { InvalidArgumentError } from "commander";
+import { z } from "zod/v4";
 import {
+  PLATFORM_SIZE_CAP_BYTES,
   YOUTUBE_APPROVED_BASENAME,
   YoutubePackSchema,
   buildPostsPayload,
   captionForProvider,
+  checkDurationCaps,
   createPostizProvider,
+  deliveryEncodePlan,
+  encodeEta,
+  ensureDeliveryFile,
+  formatMinSec,
   loadConfig,
+  probe,
+  type DeliveryPlan,
+  type DurationViolation,
   type OssclipConfig,
   type PublishPost,
   type PublishProvider,
@@ -155,14 +165,204 @@ export function selectTargets(
  * the pack's first title — the one required settings field Postiz won't
  * default.
  */
-export function buildPublishPosts(pack: YoutubePack, targets: PublishTarget[]): PublishPost[] {
+export function buildPublishPosts(
+  pack: YoutubePack,
+  targets: PublishTarget[],
+  opts: { youtubePrivacy?: YoutubePrivacy } = {},
+): PublishPost[] {
   return targets.map((target) => ({
     target,
     caption: captionForProvider(pack, target.provider),
-    ...(target.provider === "youtube" ? { title: pack.titles[0] } : {}),
+    ...(target.provider === "youtube"
+      ? {
+          title: pack.titles[0],
+          // Undefined here means `buildPostsPayload`'s own safe default
+          // (private) — one place decides it, not two (2026-08-28).
+          ...(opts.youtubePrivacy !== undefined
+            ? { youtubePrivacy: opts.youtubePrivacy }
+            : {}),
+        }
+      : {}),
   }));
 }
 
+/** `--youtube-privacy` — the values Postiz's own DTO accepts, nothing else. */
+export const YOUTUBE_PRIVACIES = ["public", "unlisted", "private"] as const;
+export type YoutubePrivacy = (typeof YOUTUBE_PRIVACIES)[number];
+
+/**
+ * `--youtube-privacy <public|unlisted|private>` → a validated choice.
+ * Rejected rather than coerced (§93a, the `--clip` idiom): a typo'd
+ * `--youtube-privacy pubic` must not silently fall back to a value that
+ * publishes to a subscriber list. Exported so the rejection matrix is
+ * testable without commander's exit behaviour.
+ */
+export function youtubePrivacyFlag(v: string): YoutubePrivacy {
+  const found = YOUTUBE_PRIVACIES.find((p) => p === v.trim());
+  if (found === undefined) {
+    throw new InvalidArgumentError(
+      `--youtube-privacy wants one of ${YOUTUBE_PRIVACIES.join(", ")}, got "${v}"`,
+    );
+  }
+  return found;
+}
+
+/** `--delivery` — what actually uploads (2026-08-29 handoff, item 1). */
+export const DELIVERY_MODES = ["auto", "master"] as const;
+export type DeliveryMode = (typeof DELIVERY_MODES)[number];
+
+/**
+ * `--delivery <auto|master>` → a validated choice, zod-parsed and rejected
+ * rather than coerced (§93a): a typo'd `--delivery masterr` silently falling
+ * back to `auto` would re-encode the one run where the user explicitly wanted
+ * the untouched master. Exported so the rejection matrix is testable without
+ * commander's exit behaviour.
+ */
+export function deliveryFlag(v: string): DeliveryMode {
+  const parsed = z.enum(DELIVERY_MODES).safeParse(v.trim());
+  if (!parsed.success) {
+    throw new InvalidArgumentError(
+      `--delivery wants one of ${DELIVERY_MODES.join(", ")}, got "${v}"`,
+    );
+  }
+  return parsed.data;
+}
+
+/** Seconds → "5:20" for the duration-cap messages — a cap named in seconds
+ * ("video is 320s") makes the user do the platform's arithmetic. Moved to
+ * core with the encode-progress work (2026-08-29) so the editor server spells
+ * ETAs the same way; re-exported here so callers keep their import. */
+export { formatMinSec } from "@ossclip/core";
+
+/**
+ * The encode-progress line: `▸ encoding delivery … 42% · ~1:50 left (1.6x)`.
+ * ETA and speed drop off rather than print garbage when ffmpeg hasn't said
+ * yet (its warm-up block is all N/A). Pure so the wording is pinned by a
+ * test; whether it lands as a \r-rewrite or a log line is the TTY shell's
+ * call below.
+ */
+export function encodeProgressLine(
+  durationSec: number,
+  p: { outTimeSec?: number; speed?: number },
+): string {
+  const pct =
+    durationSec > 0 && p.outTimeSec !== undefined
+      ? Math.min(100, Math.floor((p.outTimeSec / durationSec) * 100))
+      : 0;
+  const eta =
+    p.outTimeSec !== undefined && p.speed !== undefined
+      ? encodeEta(durationSec, p.outTimeSec, p.speed)
+      : null;
+  const tail =
+    eta !== null ? ` · ~${formatMinSec(eta)} left (${p.speed!.toFixed(1)}x)` : "";
+  return `▸ encoding delivery … ${pct}%${tail}`;
+}
+
+/**
+ * One loud line per refused channel — the platform hard-fails an over-cap
+ * upload anyway (the 5:20 take was doomed on Threads' 5:00 cap before a
+ * single byte uploaded), so the refusal names the cap instead of letting the
+ * platform's opaque error do it. Pure so the wording is pinned by a test.
+ */
+export function durationCapMessages(violations: DurationViolation[], durationSec: number): string[] {
+  return violations.map(
+    (v) =>
+      `▸ ${v.target.provider} capped at ${formatMinSec(v.capSec)}, video is ` +
+      `${formatMinSec(durationSec)} — skipping ${v.target.name}`,
+  );
+}
+
+/**
+ * The surviving targets grouped by their platform's byte ceiling
+ * (`PLATFORM_SIZE_CAP_BYTES`) — one delivery encode per distinct cap, not per
+ * channel, so two capped accounts on the same platform share one file.
+ * Uncapped targets don't appear; they ride the default delivery encode.
+ */
+export function sizeCapGroups(targets: PublishTarget[]): Map<number, PublishTarget[]> {
+  const groups = new Map<number, PublishTarget[]>();
+  for (const t of targets) {
+    const capBytes = PLATFORM_SIZE_CAP_BYTES[t.provider];
+    if (capBytes === undefined) continue;
+    const group = groups.get(capBytes);
+    if (group !== undefined) group.push(t);
+    else groups.set(capBytes, [t]);
+  }
+  return groups;
+}
+
+/**
+ * One loud line per refused channel when a platform's size cap cannot be met
+ * above the quality floor (delivery.ts: below ~1 Mbps, 1080p h264 is mush the
+ * platform would host forever) — same drop-and-continue semantics as the
+ * duration caps. The line carries the arithmetic that doomed the channel so
+ * the fix (shorten, or publish by hand) is obvious. Pure so the wording is
+ * pinned by a test.
+ */
+export function sizeCapUnattainableMessages(
+  group: PublishTarget[],
+  capBytes: number,
+  fittedKbps: number,
+  durationSec: number,
+): string[] {
+  const capMb = Math.round(capBytes / 1_000_000);
+  return group.map(
+    (t) =>
+      `▸ ${t.provider} needs ≤${capMb}MB but a ${formatMinSec(durationSec)} video fits only ` +
+      `~${fittedKbps} kbps — skipping ${t.name}; publish it manually or shorten the cut`,
+  );
+}
+
+/**
+ * The over-cap warning for `--delivery master`: master mode bypasses the
+ * encode entirely, INCLUDING the size-capped variant, so a capped platform
+ * may get a file its ingest will bounce (Instagram's 2207077). The user
+ * explicitly chose master, so this warns loudly and proceeds — the one size
+ * decision the user is allowed to overrule. Pure so the wording is pinned.
+ */
+export function masterOverCapWarning(
+  group: PublishTarget[],
+  capBytes: number,
+  masterBytes: number,
+): string {
+  const providers = [...new Set(group.map((t) => t.provider))].join(", ");
+  return (
+    `▸ WARNING: the master is ${Math.round(masterBytes / 1_000_000)}MB, over the ` +
+    `${Math.round(capBytes / 1_000_000)}MB ${providers} cap — uploading it anyway (--delivery master)`
+  );
+}
+
+/**
+ * Posts → posts with their per-platform media override set: a size-capped
+ * platform carries its own smaller encode (`PublishPost.videoPath`), everyone
+ * else rides the request's default. A capped path that EQUALS the default
+ * (the fitted bitrate came out at the 10 Mbps target, so both plans named the
+ * same file) sets no override — the provider would dedupe the upload anyway,
+ * but a redundant override obscures which posts genuinely differ.
+ */
+export function attachDeliveryMedia(
+  posts: PublishPost[],
+  defaultPath: string,
+  cappedPaths: ReadonlyMap<number, string>,
+): PublishPost[] {
+  return posts.map((p) => {
+    const capBytes = PLATFORM_SIZE_CAP_BYTES[p.target.provider];
+    const path = capBytes !== undefined ? cappedPaths.get(capBytes) : undefined;
+    return path !== undefined && path !== defaultPath ? { ...p, videoPath: path } : p;
+  });
+}
+
+/**
+ * What the confirm prompt says will upload — decided BEFORE the "yes" so the
+ * user approves the actual file, not a surprise re-encode after it. Pure;
+ * the encode itself runs post-confirm.
+ */
+export function describeUpload(mode: DeliveryMode, plan: DeliveryPlan | null): string {
+  if (mode === "master") return "master (--delivery master)";
+  return plan === null
+    ? "master (already within delivery limits)"
+    : `${plan.fileName} (delivery encode, cached in workdir)`;
+}
+
 /**
  * The pack this publish reads: the APPROVED file when the editor wrote one
  * (an edited pack is the user's decision), else the provider-keyed cache
@@ -237,6 +437,10 @@ export interface PublishFlags {
   dryRun?: boolean;
   yes?: boolean;
   force?: boolean;
+  /** `--youtube-privacy`; undefined = the payload's safe `private` default. */
+  youtubePrivacy?: YoutubePrivacy;
+  /** `--delivery`; undefined = `auto` (upload the delivery encode). */
+  delivery?: DeliveryMode;
 }
 
 /**
@@ -251,6 +455,12 @@ export async function runPublish(
     provider?: PublishProvider;
     config?: OssclipConfig;
     env?: NodeJS.ProcessEnv;
+    /** The two ffmpeg-family shell-outs, injectable so tests never spawn a
+     * binary (the `provider` seam applied to ffprobe/ffmpeg): `probeVideo`
+     * feeds the duration caps and the upload summary, `ensureDelivery`
+     * builds — or reuses — the cached delivery encode. */
+    probeVideo?: typeof probe;
+    ensureDelivery?: typeof ensureDeliveryFile;
   } = {},
 ): Promise<void> {
   const config = deps.config ?? loadConfig();
@@ -309,9 +519,87 @@ export async function runPublish(
     ) as PublishTarget[];
   }
 
+  // Probe ONCE, before the confirm prompt: the duration caps and the upload
+  // summary both need it, and a channel this video can never land on must be
+  // refused before the user says yes — not after minutes of x264 (2026-08-29
+  // handoff: Threads' 5:00 cap vs a 5:20 take).
+  const tools = { ffmpegPath: config.ffmpegPath, ffprobePath: config.ffprobePath };
+  const masterProbe = await (deps.probeVideo ?? probe)(tools, out);
+  const violations = checkDurationCaps(picked, masterProbe.duration);
+  if (violations.length > 0) {
+    for (const line of durationCapMessages(violations, masterProbe.duration)) console.log(line);
+    const over = new Set(violations.map((v) => v.target.id));
+    picked = picked.filter((t) => !over.has(t.id));
+    if (picked.length === 0) {
+      throw new Error(
+        `every selected channel refuses a ${formatMinSec(masterProbe.duration)} video — ` +
+          "nothing to publish (shorten the cut, or pick channels without a duration cap)",
+      );
+    }
+  }
+  // The plans are recomputed pure here so the confirm prompt can NAME the
+  // files that will upload; ensureDeliveryFile re-derives them (and re-probes,
+  // one cheap ffprobe each) after the "yes" to keep its cache logic
+  // self-contained.
+  const deliveryMode = flags.delivery ?? "auto";
+  const masterSizeBytes = (await stat(out)).size;
+  const src = {
+    width: masterProbe.width,
+    height: masterProbe.height,
+    fps: masterProbe.fps,
+    duration: masterProbe.duration,
+    sizeBytes: masterSizeBytes,
+  };
+  // Size-capped platforms get their own smaller encode (2026-08-29, live:
+  // Instagram's URL-fetch ingest bounced the 409MB file with 2207077 twice,
+  // then published the same take at 88MB — PLATFORM_SIZE_CAP_BYTES). A cap
+  // the video cannot fit above the quality floor drops the channel HERE,
+  // before the confirm and before a wasted encode, with the duration caps'
+  // drop-and-continue semantics.
+  let capGroups = sizeCapGroups(picked);
+  const cappedPlans = new Map<number, DeliveryPlan | null>();
+  if (deliveryMode === "auto") {
+    for (const [capBytes, group] of capGroups) {
+      const capped = deliveryEncodePlan(src, { sizeCapBytes: capBytes });
+      if (capped !== null && "unattainable" in capped) {
+        for (const line of sizeCapUnattainableMessages(
+          group,
+          capBytes,
+          capped.fittedKbps,
+          masterProbe.duration,
+        )) {
+          console.log(line);
+        }
+        const over = new Set(group.map((t) => t.id));
+        picked = picked.filter((t) => !over.has(t.id));
+      } else {
+        cappedPlans.set(capBytes, capped);
+      }
+    }
+    if (picked.length === 0) {
+      throw new Error(
+        `every selected channel's size cap is unattainable for a ` +
+          `${formatMinSec(masterProbe.duration)} video — nothing to publish ` +
+          "(shorten the cut, or publish it manually)",
+      );
+    }
+    capGroups = sizeCapGroups(picked);
+  }
+  const plan = deliveryMode === "master" ? null : deliveryEncodePlan(src);
+
   const when: PublishWhen = flags.at ? { kind: "at", iso: flags.at } : { kind: "now" };
-  const posts = buildPublishPosts(pack, picked);
+  const posts = buildPublishPosts(pack, picked, { youtubePrivacy: flags.youtubePrivacy });
   console.log(summarizePosts(posts, when));
+  console.log(`▸ upload: ${describeUpload(deliveryMode, plan)}`);
+  for (const [capBytes, group] of capGroups) {
+    const label = [...new Set(group.map((t) => t.provider))].join(", ");
+    console.log(
+      `▸ upload (${label}): ${describeUpload(deliveryMode, cappedPlans.get(capBytes) ?? null)}`,
+    );
+    if (deliveryMode === "master" && masterSizeBytes > capBytes) {
+      console.log(masterOverCapWarning(group, capBytes, masterSizeBytes));
+    }
+  }
 
   if (flags.dryRun === true) {
     const payload = buildPostsPayload({
@@ -338,8 +626,64 @@ export async function runPublish(
     }
   }
 
-  console.log(`▸ uploading ${out} to Postiz...`);
-  const result = await provider.publish({ videoPath: out, posts, when });
+  // The encodes run AFTER the confirm — 1–3 minutes of x264 each is a bad
+  // price for a "no" — and before the upload, which takes the delivery paths.
+  let uploadPath = out;
+  const cappedPaths = new Map<number, string>();
+  if (deliveryMode === "auto") {
+    // Live progress (2026-08-29): a TTY gets one \r-rewritten line; anything
+    // else (CI, a pipe) gets a plain line per 10% step — a 5-minute encode at
+    // 2 blocks/sec would otherwise write ~600 lines into the log. The state
+    // is per encode: the size-capped variant restarts the decile counter, and
+    // the onStart line names each file so the two encodes stay
+    // distinguishable in the log.
+    const isTty = process.stdout.isTTY === true;
+    const runEnsure = async (sizeCapBytes?: number): ReturnType<typeof ensureDeliveryFile> => {
+      let progressShown = false;
+      let lastDecile = -1;
+      const ensured = await (deps.ensureDelivery ?? ensureDeliveryFile)(tools, workdir, out, {
+        ...(sizeCapBytes !== undefined ? { sizeCapBytes } : {}),
+        onStart: (name) => console.log(`▸ encoding delivery file ${name} (cached in workdir)`),
+        onProgress: (p) => {
+          const line = encodeProgressLine(masterProbe.duration, p);
+          if (isTty) {
+            progressShown = true;
+            process.stdout.write(`\r${line}`);
+          } else {
+            const decile =
+              p.outTimeSec !== undefined && masterProbe.duration > 0
+                ? Math.floor((p.outTimeSec / masterProbe.duration) * 10)
+                : 0;
+            if (decile > lastDecile) {
+              lastDecile = decile;
+              console.log(line);
+            }
+          }
+        },
+      });
+      // The \r line never newline-terminated itself — without this the next
+      // line would overwrite it mid-sentence.
+      if (progressShown) process.stdout.write("\n");
+      return ensured;
+    };
+    const ensured = await runEnsure();
+    uploadPath = ensured.path;
+    if (!ensured.encoded && ensured.path !== out) {
+      console.log(`▸ delivery file already cached — reusing ${ensured.path}`);
+    }
+    // Size-capped variants next, sequentially — two ffmpegs racing for cores
+    // would slow BOTH encodes down, and the unattainable groups were already
+    // dropped above so ensureDeliveryFile's throw cannot fire here.
+    for (const capBytes of capGroups.keys()) {
+      cappedPaths.set(capBytes, (await runEnsure(capBytes)).path);
+    }
+  }
+  console.log(`▸ uploading ${uploadPath} to Postiz...`);
+  const result = await provider.publish({
+    videoPath: uploadPath,
+    posts: attachDeliveryMedia(posts, uploadPath, cappedPaths),
+    when,
+  });
   await writeFile(publishReceiptPath(workdir), `${JSON.stringify(result, null, 2)}\n`);
   const where = configured.baseUrl.replace(/\/+$/, "");
   console.log(

package/src/render-replay-args.ts

@@ -0,0 +1,50 @@
+/**
+ * The argv the editor's Render button replays (2026-08-29).
+ *
+ * A render started FROM the editor must reproduce what the user just
+ * reviewed. Replaying `command.json` verbatim did not: it carried
+ * `--produce`, so every render re-called the LLM, and the beat-sheet cache
+ * key covers the repaired words and the MEASURED framing — both of which the
+ * user's own editor work changes. The plan came back renumbered, edits
+ * anchored to scenes it no longer had were orphaned, and an approved cut was
+ * silently rewritten (the failure `produce.ts`' §143 note already named once,
+ * 2026-08-23; hit again through a different door).
+ *
+ * So the editor pins the plan on screen with `--scenes` (no LLM in the loop)
+ * and drops `--produce`. The two paths stay distinct on purpose:
+ *
+ *  - CLI/CI: `--produce` plans fresh. The command line is the authority.
+ *  - Editor: the reviewed plan is the authority; `replan` opts back in.
+ *
+ * Pure, so the whole matrix is testable without spawning a produce.
+ */
+/** The reviewed plan the editor pins for a render (see the module docstring).
+ * Its own name, never `scenes-<key>.json`: those are keyed to a beat sheet
+ * this render may no longer match. */
+export const REVIEWED_SCENES_BASENAME = "scenes-reviewed.json";
+
+export function renderReplayArgs(
+  recorded: readonly string[],
+  opts: { scenesPath?: string; replan?: boolean },
+): string[] {
+  // A deliberate re-plan replays exactly what was recorded — including
+  // `--produce` when it was there, since that IS the fresh-plan request.
+  if (opts.replan === true || opts.scenesPath === undefined) return [...recorded];
+
+  const out: string[] = [];
+  for (let i = 0; i < recorded.length; i++) {
+    const arg = recorded[i]!;
+    // `--produce` is a boolean flag: drop it alone, never a following value.
+    if (arg === "--produce") continue;
+    // An existing `--scenes <path>` is dropped WITH its value: two of them
+    // would let commander pick one, and the stale one is precisely the plan
+    // the editor is not showing.
+    if (arg === "--scenes") {
+      i++;
+      continue;
+    }
+    out.push(arg);
+  }
+  out.push("--scenes", opts.scenesPath);
+  return out;
+}